#!/usr/bin/env bash
# pfsense-ssh.sh — talk to a client's pfSense over SSH (site VPN reachable). This is the SSH backend for
# the gateway compatibility layer. DECISION (Mike, 2026-06-16): the RESTAPI package is NOT needed — with
# VPN + SSH shell we can read the same data and make changes directly. (Confirmed on Cascades pfSense Plus
# 25.07: admin SSH drops straight to a shell, no menu gotcha.)
#
# Cred from the vault: clients/<slug>/pfsense-firewall  (top-level `host`, credentials.username/password).
# Uses SYSTEM OpenSSH via an SSH_ASKPASS helper (no sshpass dependency); runs each call as `sh -s` over a
# heredoc so awk/quoting is clean.
#
# Usage:
#   pfsense-ssh.sh <slug> audit            # read-only health: version/WAN/DHCP-exhaustion/DNS/states/load
#   pfsense-ssh.sh <slug> dhcp             # DHCP pool utilization + "no free leases" check
#   pfsense-ssh.sh <slug> run "<command>"  # arbitrary command (CAN mutate — operator-gated; e.g. run "pfctl -si")
#   pfsense-ssh.sh <slug> shell            # (prints the interactive ssh command to paste)
# NOTE: `run` executes whatever you pass, including changes — there is no dry-run for it. For repeatable
# changes prefer adding a named, reviewed verb here over ad-hoc `run`.
set -uo pipefail
REPO="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
VAULT="$REPO/.claude/scripts/vault.sh"
SLUG="${1:?usage: pfsense-ssh.sh <slug> <audit|dhcp|run|shell> [args]}"
ACT="${2:?action: audit|dhcp|run|shell}"; shift 2 || true
VP="clients/$SLUG/pfsense-firewall"
HOST="$(bash "$VAULT" get-field "$VP" host 2>/dev/null || bash "$VAULT" get-field "$VP" credentials.host 2>/dev/null || true)"
U="$(bash "$VAULT" get-field "$VP" credentials.username 2>/dev/null || true)"
PP="$(bash "$VAULT" get-field "$VP" credentials.password 2>/dev/null || true)"; export PP
if [ -z "$HOST" ] || [ -z "$U" ] || [ -z "$PP" ]; then
  echo "[BLOCKED] need host + admin creds at vault:$VP (fields: host, credentials.username, credentials.password)"; exit 2; fi
if [ "$ACT" = "shell" ]; then echo "ssh ${U}@${HOST}    # password in vault:$VP"; exit 0; fi

TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
ASKP="$TMP/a.sh"; printf '#!/bin/sh\nprintf "%%s\\n" "$PP"\n' >"$ASKP"; chmod +x "$ASKP"
# pfssh: feed remote sh a script on stdin; password via askpass (stderr noise dropped)
pfssh(){ SSH_ASKPASS="$ASKP" SSH_ASKPASS_REQUIRE=force DISPLAY=:0 ssh \
  -o ConnectTimeout=12 -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no -o NumberOfPasswordPrompts=1 \
  "$U@$HOST" 'sh -s' 2>/dev/null; }

echo "[INFO] pfSense $ACT @ $U@$HOST (vault:$VP)"
case "$ACT" in
  run)
    CMD="$*"; [ -n "$CMD" ] || { echo "[ERROR] run needs a command"; exit 1; }
    printf '%s\n' "$CMD" | pfssh ;;
  dhcp)
    pfssh <<'RSCRIPT'
echo "## DHCP backend"; { pgrep -lf dhcpd >/dev/null && echo "ISC dhcpd active"; }; { pgrep -lf kea >/dev/null && echo "Kea active"; }
echo "## 'no free leases' events (exhaustion)"; clog /var/log/dhcpd.log 2>/dev/null | grep -ic 'no free leases'
echo "## active leases per /24 (top 20)"
awk '/^lease /{ip=$2} /binding state active/{a[ip]=1} END{for(i in a){n=i; sub(/\.[0-9]+$/,"",n); c[n]++} for(k in c) print c[k], k}' /var/dhcpd/var/db/dhcpd.leases 2>/dev/null | sort -rn | head -20
echo "## pool ranges (subnet -> range)"; grep -hE 'subnet|range ' /var/dhcpd/etc/dhcpd.conf 2>/dev/null | paste - - | head -40
RSCRIPT
    ;;
  audit)
    pfssh <<'RSCRIPT'
echo "## VERSION"; cat /etc/version 2>/dev/null
echo "## UPTIME/LOAD"; uptime
echo "## physical interfaces (media/status; VLAN sub-ifs skipped)"; for i in $(ifconfig -l); do case $i in *.*) continue;; igc[0-9]|em[0-9]|ix[0-9]|vmx[0-9]) m=$(ifconfig $i 2>/dev/null | grep -E 'media|status' | tr '\n' ' '); [ -n "$m" ] && echo "  $i: $m";; esac; done
echo "## GATEWAY loss/down events (last 8)"; clog /var/log/gateways.log 2>/dev/null | tail -8
echo "## DHCP exhaustion ('no free leases' count)"; clog /var/log/dhcpd.log 2>/dev/null | grep -ic 'no free leases'
echo "## DHCP busiest /24s (top 8)"; awk '/^lease /{ip=$2} /binding state active/{a[ip]=1} END{for(i in a){n=i; sub(/\.[0-9]+$/,"",n); c[n]++} for(k in c) print c[k], k}' /var/dhcpd/var/db/dhcpd.leases 2>/dev/null | sort -rn | head -8
echo "## PF states"; pfctl -si 2>/dev/null | grep -iE 'current entries|searches'; pfctl -sm 2>/dev/null | grep -E '^states'
echo "## DNS resolver"; pgrep -lf unbound >/dev/null && echo "unbound running" || echo "unbound NOT running"
echo "## mbuf"; netstat -m 2>/dev/null | head -1
echo "## NIC errors (Ierrs/Oerrs/Coll)"; netstat -i 2>/dev/null | awk 'NR==1 || ($1 ~ /^(igc|em|ix|vmx)[0-9]$/)'
RSCRIPT
    ;;
  *) echo "action: audit|dhcp|run|shell"; exit 1;;
esac
